For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Hille_de_Graaf_'s avatar
Hille_de_Graaf_
Icon for Nimbostratus rankNimbostratus
Oct 24, 2007

bypass a CRL with an invalid date

Hi,     We are using client certificates and a CRL (Certificate Revocation List) to check wether the client certificate is revocated.   Every night we are loading a new CRL from our provider ...
application delivery
dev
devops
iRules
Arley_6164's avatar
Arley_6164
Icon for Nimbostratus rankNimbostratus
May 26, 2009

Posted By capmblade on 11/09/2007 10:43 AM

 

Hello Hille,

 

I tested your rule with an expired CRL and for me anyway, it DOES allow the traffic through. I see the following three messages:

 

"Found CRL is expired -- revoking all certificates until current CRL is available."

 

Rule crltest : ClientSSL_Client handshake status: CRL has expired

 

Rule crltest : CRL date is not valid, but you may continue

 

I also tested your rule with a revoked certificate and it redirects to "certerror.htm"

 

Do you not see the "you may continue" message when you run your rule?